Third-Party Risk Disclosure Clarity Assessment

Welcome! This survey asks about the clarity and usefulness of third-party risk disclosures and mitigations at our organization. Your responses are confidential and will be reported only in aggregate to improve how we communicate vendor risk. There are no right or wrong answers — we want your honest experience from the past quarter. Participation is voluntary, and you may stop at any time. Estimated time: 6–8 minutes.

Which best describes your typical interaction with third-party risk disclosures?

• I regularly review full disclosures and mitigation plans
• I occasionally review full disclosures
• I rely on summaries but not full disclosures
• I do not review these

Where do you typically access third-party risk information? Select all that apply.

• Email digests
• GRC dashboard
• Policy or vendor risk reports
• Meeting briefings
• Slack/Teams updates
• Wiki/knowledge base
• Other

Thinking about the past quarter, how clear is the risk scoring and severity rating in our third-party risk disclosures?

Rank the following improvements by how much they would help you understand third-party risk disclosures (drag to rank, top = most helpful).

1. Plain-language executive summary
2. Visual risk heatmap with legends
3. Mitigation plan with owners and due dates
4. Change history/changelog of risk posture
5. Links to detailed assessments and evidence

Please share one recent example (last 60 days) where the clarity of a third-party risk disclosure helped or hindered a decision you made.

Overall, how satisfied are you with the clarity of third-party risk disclosures and mitigations over the past quarter?

What is your primary role?

• Risk/GRC
• Security
• Procurement
• Legal/Privacy
• Engineering/IT
• Finance
• Operations
• Executive
• Other

Thank you for your time. Your input will directly inform how we improve third-party risk disclosures and mitigations across the organization.

In the past 3 months, how often did you review vendor risk disclosures?

• Not at all
• Less than monthly
• Monthly
• Weekly
• Daily

How easy is it to locate a specific vendor's current risk rating and mitigation status using your primary tool (e.g., GRC dashboard)?

How clear are the mitigation plans and control descriptions in our third-party risk disclosures (past quarter)?

Which mitigation elements are hardest to interpret? Select all that apply.

• Technical controls (e.g., encryption, segmentation)
• Process changes or compensating controls
• Timelines and milestones
• Residual risk quantification
• Ownership and escalation path
• None — it's clear
• Other

We'd like to explore your experience with third-party risk disclosures in a bit more depth. An AI moderator will ask you a couple of follow-up questions based on your responses.

What is your seniority level?

• Individual contributor
• Manager
• Director
• VP
• C-level
• Other

How prominently is vendor risk status surfaced within the tools you use day-to-day (e.g., dashboards, trackers, notifications)?

How clear is the residual risk and ownership/accountability information in our third-party risk disclosures (past quarter)?

If a vendor incident were reported today, how confident are you that you would know the immediate next steps?

Based on your responses in this survey, is there anything else you would like to share about making third-party risk disclosures clearer or more useful for you?

How long have you been in your current role?

• Less than 1 year
• 1–2 years
• 3–5 years
• 6–10 years
• More than 10 years

Overall, how would you rate the plain-language readability of our risk write-ups and mitigation descriptions over the past quarter?

Which region are you primarily based in?

• Americas
• EMEA
• APAC
• Other